pf

is a bsd package filter. Reading a bit about it, the api is

/dev/pf

. It’s obviously possible to write something 🙂